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We calculate an achievable secret key rate for quantum key distribution with a finite number of 
signals, by evaluating the min-entropy explicitly. The min-entropy can be expressed in terms of the 
guessing probability, which we calculate for d-dimensional systems. We compare these key rates to 
previous approaches using the von Neumann entropy and find non-zero key rates for a smaller num- 
ber of signals. Furthermore, we improve the secret key rates by modifying the parameter estimation 
step. Both improvements taken together lead to non-zero key rates for only 10 4 — 10 5 signals. An 
interesting conclusion can also be drawn from the additivity of the min-entropy and its relation to 
the guessing probability: for a set of symmetric tensor product states the optimal minimum-error 
discrimination (MED) measurement is the optimal MED measurement on each subsystem. 



I. INTRODUCTION 

Quantum key distribution (QKD) is the establishment 
of a random secure key between two authorized parties, 
Alice and Bob, which are connected with each other via 
a quantum and a classical channel pQ. Qubits (e.g. pho- 
tons) are distributed over this quantum channel, and in 
practical implementations the number of these particles 
is finite. Dealing with these finite resources, a new branch 
in quantum key distribution (QKD) emerged, the finite- 
key analysis. It investigates secure key rates, i.e. the 
ratio of a secure key length to the number of signals 
sent through the channel, in the non-asymptotic situa- 
tion. The security of a finite key for a composable secu- 
rity definition [2H1] was proven in [ST-flO] . It is important 
to notice that composability means that the key estab- 
lished by QKD can be used safely in any application such 
as one-time-pad encryption. For a review on practical 
QKD and its security, see e.g. Refs. [HJ [12]. Calcula- 
tions of finite key rates were done in [HI Ell [T3] and in 
[T5] for d dimensions. The relevance of finite QKD was 
shown in [16] : practical implementations of QKD lead 
to a dramatically lower secure key rate in comparison to 
asymptotic theoretical predictions. 

The paper is organized as follows: in Sec. [H] we de- 
scribe a general QKD protocol, in Sec. Ill we review a 



bound for the statistical error in parameter estimation 
and show that former results on the secret key rate [5] can 
be improved by considering a POVM with two outcomes. 
In Sec. |IV| we concentrate on quantifying the secret key 
length after privacy amplification. It was found in [51 [TO] 
that the conditional min-entropy gives an achievable up- 
per bound on the secret key length. The calculation 
of the conditional min-entropy involves an optimization 
over a set of quantum states. A lower bound on the 
min-entropy by using the conditional von Neumann en- 
tropy was established in EI] . This bound holds under 
the assumption of collective attacks, i.e. the state shared 



between Alice and Bob after Eve's interaction has ten- 
sor product structure. In Sec. [V] we calculate the min- 
entropy explicitly by applying recent results on its oper- 
ational meaning [17] . For the qubit case, we evaluate the 
min-entropy for the BB84-protocol lj via minimum-error 
discrimination (MED). For d-dimensional quantum sys- 
tems, we calculate it for the generalized six-state-protocol 



[T51 IP5] via the square-root measurement. In Sec. IVI 
we compare the key rates via calculation of the min- 
entropy to the bound with the von Neumann entropy. 
We show that our approach gives positive key rates for 
a smaller number of signals compared to the von Neu- 
mann approach. Furthermore we compare our results in 
the d-dimensional case to the recent results in [15] for the 
mentioned bound. We conclude in Sec. IVII1 



II. QUANTUM KEY DISTRIBUTION 
PROTOCOL 

We consider an entanglement-based QKD scheme. In 
the following a description of the protocol will be pro- 
vided. 

1. Distribution: Alice prepares N maximally entangled 
states in dimension dx d, where d is the dimension of the 
Hilbert space of a subsystem: 
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and sends the second particle to Bob. In the case of 
qubits, i.e. d = 2, the state is one of the four Bell-states 
|$ + ). After the distribution, they share N entangled 
pairs, which we will denote by the state p~A N b n . Under 
the assumption of collective attacks, the state Pa n b n is 
a tensor product state, i.e. p~A N b n — (pA B f N M- Alice 
and Bob can symmetrize the state pab by applying a de- 
polarizing map, leading to a cP-dimensional Bell-diagonal 
state © El Q5]: 
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where 



the generalized Bell states 
has the following form: 
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where Pi, 



W (Vi 



Si.-i Aij 



1 and 



|i/>) " if / \ru 

{|$+) , |$") , |#+) , I*")} is the Bell basis. 

For a specific depolarizing map, one can parametrize 
the state pab by one parameter Q, which in the two- 
dimensional case is the quantum bit error rate (QBER). 
The relation between Q and Xjk will be explained in 
Sec. E| 

2. Encoding and measurement: Both parties agree on 
an encoding, i.e. each quantum state is associated with 
a symbol from an alphabet. They perform a projection 
measurement in certain bases. 

After this step Alice and Bob will share N correlated 
pairs of dits (d-letter systems). 

3. Sifting: In this step both parties announce for each 
qudit pair the encoding they have chosen. Depending 
on the protocol either they discard the data, when they 
differ, or they use them for parameter estimation. The 
bit string after this process has length N — n', when n' 
bits were discarded. 

4. Parameter estimation (PE): Parameter estimation 
serves for estimating the error in the quantum chan- 
nel by using measurements, in general a positive oper- 
ator valued measure (POVM). The considered state is 
parametrized by the quantum bit error rate (QBER) Q 
for d = 2. To measure the QBER a chosen POVM is 
used. Due to the finite number of signals (m randomly 
chosen signals are used) the QBER cannot be detected 
perfectly. Therefore a quantification of the statistical er- 
ror is needed. 

After parameter estimation the number of signal states 
is n = N — n' — m. 

5. Error correction (EC): In this step Alice and Bob 
want to eliminate the error in their classical data, which 
might be there because of eavesdropping. In order to 
reconcile their data, they have to communicate publicly. 
In this paper, we will use known results [9] to account for 
the effect of error correction on the key. 

6. Privacy amplification (PA): During the key genera- 
tion, information about the key might have been revealed 
to the eavesdropper. To reduce this information, Alice 
and Bob apply a randomly chosen hash function from a 
family of hash functions to their identical keys. 



III. IMPROVED PARAMETER ESTIMATION 

Parameter estimation plays an important role in fi- 
nite QKD protocols. Since one has a finite number of 
measurement outcomes, one needs an appropriate esti- 
mate for each parameter. In this section we first remind 
the reader of a method for parameter estimation used in 



[ni[TH[2T]. There, the parameters were estimated by dif- 
ferent two-dimensional POVMs for different bases. We 
will then show that we can reach a better approximation, 
if we consider one specific POVM for the estimation of 
all parameters. The following theorem quantifies the un- 
avoidable statistical errors in the estimated parameters. 

Theorem 1. Let { B i\^i be a \x\- dimensional 

POVM, X m = (A m (l),A m (2),..,A m (|x|)) and X x = 
(Aoo(l), Aoo(2), .., Aoo(lxD) t ne probability distributions, 
with X(i) being the probability of outcome Pi. Here, the 
index m stands for the m-fold independent application of 
the POVM on identical states p. Let now X m : — A m (/c) ; 
Aoo := Aoo(fc) denote any k-th parameter. Then except 
with probability £pg 



|A m - XooWx < C(epe, \x\, m ), 
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where \\A\\ 1 = tr V A? A and In denotes the natural loga- 
rithm jisy . 

Proof: See Appendix. 

To clarify the influence of different choices of POVMs 
on secure key rates we consider a protocol, where Alice 
and Bob share a state, which can be parametrized by npE 
parameters. We choose the variables of the estimation of 
each parameter in a symmetric way. That means £pE; = 
Sp|:lx|i = \x\,mi = ^ for all i G {l,...,n PE }, such 

that the constraints J27=i £pE i = £pE an< ^ m i = m 

are fulfilled. 

In previous works [9l 1 14] each parameter is estimated 
by an individual two-dimensional POVM (in the follow- 
ing we will use IPOVM as an abbreviation for this ap- 
proach); e.g. for the BB84 protocol, we have two param- 
eters (error rates in two bases) to estimate. Then we 
need two POVMs, where each of them has two outcomes 
which correspond to "Alice and Bob do have the same 
measurement outcome" and "Alice and Bob do not have 
the same measurement outcome" in their respective mea- 
surement basis. This leads to £(^ip, 2, ™). Generally for 
states determined by npE we get ^(■ §EE -, 2, ^_) for each 
parameter. 

Concerning secure key rates we can improve this 
method by considering a common POVM with npg + 
1 measurement outcomes (CPOVM approach). This 
means for example for the BB84 protocol that we use a 
POVM with 3 outcomes, where two of them correspond 
to "Alice and Bob do not have the same measurement 
outcome" in each of the two bases and one corresponds 
to the completeness of the POVM. Then, the estimation 
of each parameter will be represented by £(£p E ,3,m). 
In general for npE + 1-dimensional systems the devia- 
tion from the perfect parameter (see Eq. Q) is given 



3 



by £(epE,"-PE + l,7ra). The improvement is due to the 
fact that in Eq. Q the trace distance is only bounded 
by £(£pE> lxli TO ) an d that the parameters according to 
the CPOVM approach lead to a smaller bound than the 
IPOVM approach. The results of an explicit calculation 
of the key rates will be provided in the last section. 



IV. PRIVACY AMPLIFICATION AND THE 
e-SMOOTH MIN-ENTROPY 

In this section, we will present some results about the 
min-entropy. Starting from the connection of the min- 
cntropy to the secure key length after the privacy ampli- 
fication step, we review the relation of the min-entropy 
to the guessing probability given in [17] . 



A. The e-smooth min-entropy and the secure key 
length £ 

The e-smooth conditional min-entropy provides an up- 
per bound for the secure key length £ after the privacy 
amplification step [10] : 



(6) 



where pxe = Y^,x=oP^ \ x ) ( x \®Pe IS a classical- quantum- 
state, which Alice and the eavesdropper Eve share after 
error correction. Here, X is Alice's random variable with 
values x G {0, d — 1}, where d is the dimension of the 
quantum system. The eavesdropper holds a quantum 
state p E , which is correlated with the random variable 
X. The symbol E n denotes the eavesdropper's system. 
The parameter n is the number of signals after sifting 
and parameter estimation, i.e. n — N — n' — m. 

In the following we will denote the state pxe as a 
single-signal state, i.e. following the description above, 
both parties share one single state (n = 1). Otherwise, 
the state will be denoted by p XE , if it has tensor product 
structure. We treat collective attacks, as the state shared 
between Alice and Eve has in this case tensor product 
structure. Collective attacks \2'6V ] are those attacks 
where the eavesdropper is restricted to interact with each 
of the signals separately, i.e. by attaching an auxiliary 
system and performing unitary transformations. In [SI [7] 
it was shown that it suffices to consider a convex combi- 
nation of product states, when analyzing the full security 
of QKD protocols. However, it does not follow that we 
can consider w.l.o.g. a product state. 

We recall the definition of the e-smooth min-entropy: 

Definition 1 (e-smooth min-entropy [TO]). Let pxe € 

B" 2 {pxe) ■= {pxe > : \\pxe-PxeWj_ < e}. The 
e-smooth min-entropy is defined as: 



with 

Hmin(pxE\E) = sup [- log 2 (min A : A • l x ® o E > Pxe)} 

(8) 

The optimization in Eq. ^ is done over the states px e 
in the e-environment of pxe, whereas the optimization 
in Eq. (|8b is over all states o~e ■ 



B. The min-entropy and the guessing probability 

The evaluation in Eq. ^fh is a convex optimization 
problem. It was shown in [17] . that the min-entropy can 
be rewritten as the negative logarithm of the optimal 
guessing probability p : 



H mia (p XE \E) = -log 2 p 



(9) 



where 
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Pxe 
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(Pxe\E), 



(7) 



Pguess = Pguess(^l^) ■= max yVtr^fpf,). (10) 

{Ee) x=0 

Here it was used that the initial state pxe is a classical- 
quantum state (see above), which is shared between Al- 
ice and Eve, the eavesdropper. The set {E E } denotes the 
POVM elements of Eve, which she uses in order to dis- 
tinguish her nonorthogonal ancilla states p x E . If she could 
perfectly discriminate them, she would know the value of 
Alice's random variable X and therefore the content of 
the secret key. 



V. EVALUATION OF THE GUESSING 
PROBABILITY 

In this section we will present an explicit calculation 
of the guessing probability in Eq. ([To ) for c?-dimensional 
quantum systems for the generalized six-state-protocol 
via square-root measurement (see e.g. [24-29 ), and 
for qubit-systems [d = 2) for the BB84-protocol via 
minimum-error discrimination 26, 30 33J . The problem 
of distinguishing two mixed quantum states with min- 
imum error was solved by Helstr0m [32 , but for more 
states it becomes more involved. For quantum states 
with a certain symmetry, optimal measurements were 
found (see e.g. [IS]), whereas for arbitrary states only 
bounds exist |34j . Finally, we draw a conclusion from the 
additivity of the min-entropy for tensor product states: 
for a set of symmetric tensor product states the opti- 
mal minimum-error discrimination (MED) measurement 
is the optimal MED measurement on the subsystems. 



A. Generalized six-state-protocol for d-dimensional 
quantum systems 

In this part we consider a (d+ l)-bases protocol, which 
was introduced in 35-37]. It is a generalization of the 
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six-state protocol jTSJ H] • We further assume a collective 
eavesdropping attack. Due to symmetrizations [6] the 
eavesdropper is forced to introduce the same error in each 
measurement basis. This symmetrization leads to the 
following Bell-diagonal state shared between Alice and 
Bob (see Section [TT| : 

PAB = (Po ~ Pi) |$00> (*00| + yl«P, (11) 

with p + (d- = 1, < Pi < i < Pa < 1 and l<p 
being the identity matrix of size d 2 . Note that this form 
is equal to the one considered in [3H1 ES] ■ The parameter 
Po can be seen as the probability that both get the same 
output, whereas Pi denotes the probability that they get 
a particular other one. The error rate Q is given by 
Q := 1 — Po = (d — l)Pi; for d = 2, Q is the quantum 
bit error rate Pi. The state in Eq. ( 11 ) can be recovered 



from Eq. Q by setting A 00 = 1 - ^M 1 - Po) and all 

other A l. = (x r M = 01 
omer A jk — dj - d _ 1 ) — d ■ 

We assume that Eve holds a purification \iPabe)- Eve's 
reduced state is [551 



states are orthogonal and she can perfectly discriminate 
them. For the case x = y, Eve has to discriminate d pyra- 
mid states. Measurements for such symmetrical states 
exist, and it is known that the error- minimizing mea- 
surement for such states is the square-root measurement 
[24ll29j . The following results for the tomographic pro- 
tocol were derived i n [591 |4"0] : 

The state in Eq. ( 12 ) can be rewritten as: 



PE =P0P M + (1-P0)P&\ 



(15) 



where the density operator = 
denotes the cases, when Alice 
values, whereas in the 



same 
l 



" d ^2x=0 \ E xx) (E X x\ 

and Bob have the 
case of p&> — 
d(d-i) Ey/x \ E xy) (E xy \ their values are different. The 
eavesdropper wants to find their common values, so she 
wants to discriminate those ancilla states for x = y. The 
POVM elements \e xx ) (e xx \, that discriminate the pyra- 
mid states with minimum error, are given via 



1 
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Pe 
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~ [po J2 \ E **) ( E **\ +AE \ E *y) ( E * 



x=0 



and we define the normalized states p E as: 



(12) 



p% := Po \E XX ) (E xx \ +PiY, \ E *y) ( E *v\ > (13) 

y^x 

such that Eve's state is given by pe = \ J2 x Pe- Eve's 
ancilla states \E xy ) have a specific form in order to fulfill 



terms of an orthonormal 



the requirement in Eq. (11). They can be written in 

Dasis of Eve {\fij) E }- 



\ E xy) 



- ) VPo 



h Hk=o y/*o*w xk l/o,k) E ioix = y 



1 sr^d—l x k I <• 



y/d 



for x 7^ y, 



(14) 

with w :— e 27ri / rf and A^fc given above. The ancilla states 
with x — y have a fixed angle between each other, they 
are called pyramid states [39]. They fulfill 



{E X y | E x ', 



if x = x' and y = y', 
| iix = y^x'=y', 
otherwise. 



The eavesdropper would like to know Alice's and Bob's 
classical value x and y, respectively. For the case x =/= y 
she knows both values with certainty, as those ancilla 



i.e. the name square-root measurement is related to the 
construction of the elements. An explicit calculation for 
the operator —J^ = results in [55] : 



(rp + yr ri + n)l - p 
y/ron (y/ro + -v/n 



(=) 



1 

\7P 



where ro = 1 — |^ is the eigenvalue corresponding to 
the eigenvector J2 X \E XX ) and n = jg- is the (d — 1)- 
fold eigenvalue for the eigenvector (\E XX ) — | J2 y \E yy })- 
From this the overlap (e xx \E yy } can be calculated as 

(e xx \E yy ) = y/rjo5 xy + 071(1 - S X y), 



with 



/n,+(d-i)^/rT 

y/d 



y/d 



— and S xy the 



Kronecker delta. The probability 770 denotes the proba- 
bility that Eve, when finding |e xx ), knows that Alice and 
Bob share the value x and rji denotes the probability that 
they hold one of the other d — 1 values. 

The eavesdropper's probability to guess the right value 
of Alice consists of the following parts: the probabil- 
ity (1 — Po) that the density operator p&) appears (see 
Eq. ( fl5| )) and the probability p Q that p( = ) appears multi- 
plied with the probability that she guesses the right value 
in this case, which was r/o (see above) . Inserting ro and r\ 
into 770, we get an expression for the guessing probability 
depending on d and the error rate Q = 1 — Po- 



Pgu X css atC K Q) = l~Po + PoVO = Q + 



(i-O) 



d(Q-l) 



(d-l)d 2 (l-Q) 2 



(16) 
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B. BB84 for qubit-systems 

A strategy to distinguish two nonorthogonal quantum 
states is called minimal-error discrimination (MED) (see 
[2"6l 1501- 33 ) . In MED for each measurement one has a 
conclusive result, but with probability p clr the result is 
erroneous. It was shown by Helstr0m [32] that the maxi- 
mal probability to make a correct guess when distinguish- 
ing two quantum states p° E and p E that appear with the 
same probability po = p\ = | is given by 



Pguess(2, Q^) 1 



n mm 



i 



p e \ 



(17) 



Finding the maximum of the expression leads to the 
result u = v = Q and finally to the expressions of Ay: 
Aoo = (1 - Q) 2 , Aoi = Am = (1 - Q)Q and An = Q 2 . 
This gives the guessing probability: 



P 



gu B ess (2, Q) = \ (l + 2y/(l -Q)Q) . (23) 



By using the same methods we can derive the guessing 
probability for the six-state protocol, which lead to the 
same result as derived in Eq. (16): 



six— state 
guess 



1 



(2,Q) = -(1 + VQ(2-3Q) + Q). (24) 



In order to calculate \\p E — Pb|L, we express the states 



p E and p E (see Eq. (13)) in terms of the computational 
basis of Eve. 

Assuming that Eve has a purifying system of the state 
in Eq. ^3|, and that Alice and Bob perform a von Neu- 
mann measurement, one can derive an expression for 
— Pe\\i f° r t ne BB84-protocol. The operator p E —p E 
can be written as 



p% - p E = 2VA 00 Aoi (|00)<01| 



loixooi) 

+2VA 1 oA 11 (|10)(ll| + |ll)(01|), 



(18) 



so 



\p% - Pe \ = 2\A 00 A i (P| 00 > + P\oi)) 



+2VAioA u (P m +P\ u) ), (19) 

with |^4| = \J AS A. The eigenvalues 2\J A00A01 and 
2VAioAix occur with multiplicity 2. Thus the 1-norm 
is 



1, 



Pi 



1 1 — 2\J AqoAqi + 2\J AioAn 



(20) 



The error rates in the z- and x-direction are e z = 
A10 + An and e x — Aoi + An (see [TUJ [T2]). There re- 
mains one free parameter, that we have to optimize to 
obtain the best case for Eve. We adopt the method in 
[121 Appendix A] to maximize the probability of cor- 
rect guess in Eq. (17): according to [12], we choose 
Aoo = (1 — Q)(l-tt), A i = (l-Q)w, A10 = Q(l-v) and 
An = Qv, with [0, 1] and the additional constraint 

(from Aoi + An = Q) 



(l-Q)u + Qv = Q. 



(21) 



Defining |3>jj) as the corresponding Bell states to the 
value Xij , the purification of the state pab can be written 

as \iPabe) = \/K \®h)ab ® \ e v)s' where {l e u>} is 



a four-dimensional orthonormal basis. Using Eq. ( 20 ) 



and the constraint given in Eq. (21) we find a function, 



which depends on the parameter v: 
1 



\P° E 



Pe\ 



f(v) :=2v^l 



v) v < 



v) Q [l + (v-2)Q] 
2 - (22) 



C. Optimal multistate MED measurement from 
additivity of min-entropy 

We know from [10] that the min-entropy is addi- 
tive, i.e. for tensor product states it holds that 
H min {p%\E n ) = nH min (p XE \E). The min-entropy is 
a function of the probability of a correct guess of Eve's 
states. The state ^ is of the form: 



\ x=0 



An l^i 




x; \x\ p E „ 



ce{o,...,d-i} n 



where 



i=0 



(25) 
(26) 

(27) 



and x = (xo, ...,x n -i) is a vector of length n with Xi € 
{0, d — 1}. Thus, Eve's state is given by 



pT 



-y 

An 



Pe*> 



(28) 



and is a sum of tensor product states, see Eq. (27). The 



explicit minimum-error discrimination problem is to dis- 
tinguish the set of states {p E n} for different x. We can 
conclude from the additivity of the min-entropy, that for 
the set of states given in Eq. (271 the optimal MED mea- 



surement consists of optimal MED measurements on the 
single-signal states p E . This result is interesting, as in 
general measurements in the total Hilbert space may lead 
to higher guessing probabilities than measurements in in- 
dividual subspaces. To the best of our knowledge, this 
result is not known in the context of state discrimination. 



VI. COMPARISON OF KEY RATES 

In this chapter we provide the results of parameter es- 
timation with CPOVM (see Sec. Ill) and those of the 
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calculation of the min-entropy (see Sec. [v]). We first re- 
view some results about finite-key distribution. 

For a finite number of signals, the achievable secure 
key rate is found to be [9] [14] : 



n 2 
ii/N = — (S^pxeIE) + A - leak EC ) + - log 2 (2 £pA ) , 

(29) 



with A := — 7y log2 ^ 2 / 6 ) } the total security parameter e 
(see e.g. [HE]) 



£ = £PA + £ec + £PE 



(30) 



and S^(pxe\E) := mhip XBe r t S(pxe\E). The set T 6 = 
{a : \\\ m — A 00 (cr)| < £} contains all states compatible 
with the statistics in parameter estimation. The condi- 
tional von Neumann entropy with the correction term 
A is a lower bound on the e-smooth min-entropy. The 
leakage term leakEc is taken from [12] to be leaksc = 
1.2h(Q) for £ec = 10 -10 , where h(x) is the binary en- 
tropy. Throughout all calculations, we assume asymmet- 
ric protocols with a symmetric attack. An asymmetric 
protocol means that one only keeps the measurement re- 
sults of one particular basis for the key; the other results 
are used for parameter estimation. In the case of proto- 
cols with (d + 1) bases (e.g. the six-state protocol with 
d = 2) this basis is chosen with probability q = (1 — dp) 
and the other d bases with probability p. For proto- 
cols with 2 bases (e.g. the BB84-protocol with d = 2) 
q = 1 — p. Taking the largest deviation £j from the per- 
fect parameter in one measurement basis and equating 
it with the other deviations, leads to a symmetric choice 



of parameters and £pE; , i.e. mi 



d+l 



(rrii 



for 



2— bases protocols) and epEi = fq^f (epEi = £ 2 £ ) (see 
section [nT] ) . This assumption gives a lower bound on the 
secret key rate. The number of signals used for parameter 
estimation is given by m = Np 2 . 

In order to calculate the key rate, we fix e and £ec an d 
maximize £\/N in Eq. (29 1 for the parameters £pe, £pa, £ 
and q with a computational software program (Mathc- 
matica) under the constraint given in Eq. (30). 



A. Key rates via von Neumann entropy for 
different approaches of parameter estimation 

For a comparison of the approaches (IPOVM, 



CPOVM) explained in Sec. Ill we consider the asymmet- 
ric BB84- and six-state-protocol for a symmetric attack 
for dimension d = 2 as discussed in [5]. In the calcula- 
tion of the key rates via the von Neumann entropy (see 
Eq. ( 29 )) we use a QBER of Q — 0.05 and a total security 
parameter of e = 10~ 9 (see Eq. (30)). The conditional 
von Neumann entropy for the six-state protocol is given 
byiaiH]: 



s : 



six— state 



( P xe\E) = (1 - Q) 



1 - h 



l-O 



(31) 



and for the BB84-protocol 

S bbm ( P xe\E) = 1 - h(Q). 



(32) 



The variables £ for parameter estimation used in this 
comparison are summarized in Tab.|l] Note that the sym- 
metrized state is parametrized by only one parameter. 
This has no influence on the IPOVM approach, in con- 
trast to CPOVM, where the number of POVM outcomes 
can be reduced from 3 for BB84 (4 for six-state) to 2 (2). 





BB84 


six-state 


IPOVM 


e(^,2,f) 


£(Sfs2,f) 


CPOVM 


£(epE, 2, m) 


£(£pe, 2, m) 



TABLE I. Deviations £ from perfect parameter (see Eq. Q 



in Sec. Ill I for different parameter estimation approaches 



(IPOVM and CPOVM): BB84 and six-state protocol. 

The results are shown in Fig. [1] and [2] We point 
out that our CPOVM approach leads to higher key rates 
for the BB84- and six-state-protocol. In particular for 
signals TV < 10 11 , the numerical analysis reveals the im- 
portance of parameter estimation. While the CPOVM 
approach leads for V = 10 6 signals to a 72% (35%) 
higher key rate than the IPOVM approach for the six- 
state- (BB84-) protocol, the improvement for V = 10 10 
is still 3% (2%). 



0.4- 



0.2 
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FIG. 1. (Color online) Comparison of the key rates (calcu- 
lated via the von Neumann entropy, see Eqs. (29 1 and (|32[)) 



using different parameter estimations for asymmetric BB84- 
protocol; e = 10" 9 , Q = 5%; squares (red): CPOVM, trian- 
gles (black): IPOVM (see Sec. Ill for explanations). 



B. Key rates via the min-entropy for 
two-dimensional quantum systems 

In this section we exploit the preceding results from 
Sec.[V]regarding the min-entropy in order to compute the 
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FIG. 2. (Color online) Comparison of the key rates (calcu- 
lated via the von Neumann entropy, see Eqs. ( |29[ ) and ( |31[ l) us- 
ing different parameter estimations for asymmetric six-state- 
protocol; e = 1(T 9 ,Q = 5%; squares (red): CPOVM, trian- 
gles (black): IPOVM (see Sec. Ill for explanations). 



secret key rate and compare it to the key rate calculated 
with Eq. p9l). 



We explained in Sec. IV that the achievable upper 
bound on the secure key length £ after the privacy am- 
plification step is given by Eq. ^. We can derive a key 
rate by using the following bounds 10, Lemma 3.2.6]: 

H e min ( P T E \E n ) > nH%£(p XE \E) > nH mhl (Px E \E); 

the last inequality is a very good approximation as s is 
in the order of 10~ 10 . Thus, we arrive at the following 
key rate: 



hlN = — {H min ^( PxE \E) - leak EC ) 



N 



log 2 (2e PA ) , 
(34) 

where the leakage term leak^c and Spa are the 



same 



in Eq. (29), and H min ^(p XE \E) 



H min (p XE \E) (see Eq. pk). We calcu- 



late this key rate using the connection to the guessing 
probability, i.e. H^ oco \p XE \E) = - log 2 pg^™ 1 (see 
Eq. ([9])), and compare it to the key rate given in Eq. (29). 
The guessing probability for the specific protocol is given 
by Eqs. (pi and @. 

In Fig.]3fthe threshold number of signals No, where the 
key rate becomes non-zero, is plotted as a function of the 
QBER Q. For parameter estimation, we have considered 



the CPOVM approach (see Sec. Ill) with the variables 
given in Tab. [TJ Additionally, we have plotted the key 
rate via the von Neumann entropy (Eq. (29)) for the 
IPOVM approach. In comparison to the von Neumann 
approximation (Eq. (p9|), only 1/2 (7/10) of the number 



of signals is needed for non-zero key rates in the six-state- 
protocol for Q = 0.2% (Q — 3.8%), when using the min- 
entropy. For the BB84-protocol, only 1/2 (9/10) of the 
number of signals is needed for Q = 0.2% (Q = 3.8%). 



FIG. 3. (Color online) Threshold value iVo (number of 
signals, where the key rate becomes non-zero) vs QBER 
Q with e = 10 -9 and eec = 10 -10 ; triangles (red): 
BB84-protocol, squares (black): six-state-protocol; filled: 
min-entropy (Eq. ( 34 1 ) , open: von Neumann entropy with 
CPOVM approach (Eq. J29|), dashed line: von Neumann 



entropy (Eq. (29])) with IPOVM approach (see Sec. [TTT] for 
explanations) . 



Thus, by calculating a key rate explicitly with the min- 
entropy, we get positive key rates for a smaller number 
of signals than via the von Neumann entropy approach. 
This behavior can be explained by the correction term A 



in the key rate in Eq. (29). For a small number of total 



signals V, this correction term is not a good approxima- 
tion and has a big impact on the key rate. 

We point out that for low Q we can achieve non-zero 
key rates with only O(10 4 ) - 0(1O 5 ) signals. Note that 
in [H] it was considered a "milestone" to reach non-zero 
key rates for significantly less than 10 5 — 10 6 signals. 



Key rates via the min-entropy for d-dimensional 
quantum systems 



In [T3] the influence of the dimension on the key rate 
was discussed. Exploiting the results from this paper, 
we discuss the improvement for higher-dimensional quan- 
tum systems. Throughout this part we only consider the 
(d+ l)-bases protocols, such as the six-state-protocol for 
d = 2. Furthermore, we adapt our CPOVM approach 
and by using Eq. Q from Sec. Ill we get £ (epE,2,m). 
The correction term to the (i-dimcnsional von N eumann 

log 2 (2/s) 



entropy is given in [42] as A = —(2 log 2 d + 3) 
and the leakage term is characterized by leaksc = 
l.2h d {Q) with h d {p) := -plog 2 ( 3 P T )-(l- p )log 2 (l-p). 
The conditional von Neumann entropy was calculated in 



[H] as 



S d ( PxE \E) = {l-Q) 



log 2 d-h d [l- 



1 - 



i+i 

d 



Q 



l-Q 



(35) 

where Q = 1 — /3q denotes the error rate in the sifted 
key. We will compare the key rate calculated via the d- 
dimensional conditional von Neumann entropy, with the 
one via the d-dimensional min-entropy. The latter can 
be obtained by using 



Hi in (p x E \E) = -log 2I 



(36) 



where p gU ess {d, Q) was given in Eq. (16 1. 



In order to quantify the number of signals, we have 
scaled Nq with log 2 d, as for example sending one state 
in the dimension d = 4 corresponds to sending two states 
in the dimension d = 2. For making the key rate compa- 
rable to the two-dimensional case, it has to be divided by 
log 2 d. The dimensions are prime numbers as complete 
mutually unbiased bases can be formed for primes and 
prime powers (see e.g. review article |43j ) . 




FIG. 4. (Color online) Key rates with d-dimensional condi- 
tional von Neumann entropy (Eq. (35 1 ) plotted versus scaled 
total number of signals for a fixed error rate Q = 5%. This 
is analogous to 15., where a different scale was used for the 
axes. 

Figure [4] sh ows the behavior of the key rate calculated 
with Eq. (|35[) for different dimensions. In contrast to 
[15] . we scaled the key rate with the dimension. It can 
be seen from the plot, that higher dimensions are advan- 
tageous as the key rate increases. In order to obtain the 
behavior for a small number of signals, Fig. [5] provides 
a magnification of this area. The higher the dimension, 
the more the point, where the key rate becomes non-zero 
is shifted to the right (apart from the case d = 2). This 
might be due to the correction term, as it scales linearly 
with the dimension, so for higher dimension, more is sub- 
tracted from the conditional von Neumann entropy. We 
will see in the next paragraph, that the min-entropy ap- 




N*log,d 



FIG. 5. (Color online) Key rates with d-dimensional condi- 
tional von Neumann entropy (Eq. ( |35[ )) plotted versus scaled 
total number of signals for a fixed error rate Q — 5% (Mag- 
nification of Fig. Hb. 



proach has an advantage over the von Neumann entropy 
approach for a small number of signals. 




0.05 



FIG. 6. (Color online) Threshold value No (number of signals, 
where the key rate is positive) vs QBER with e = 10 -9 and 
eec = 10 -10 for different dimensions d G {2, 3, 7, 17}. Dashed 
line: min-entropy (Eq. (36 1), straight line: von Neumann en- 
tropy (Eq. p)). 



In Fig. [6] we compare the number Nq, where the key 
rate becomes non-zero, for key rates using the quanti- 



ties given in Eqs. (351 and (361 for different dimensions 



It can be seen that the min-entropy approach is better 
throughout the presented error rates. The advantage of 
the min-entropy approach (Eq. (36)) over the von Neu- 
mann approach (Eq. (35)) augments with increasing di- 
mensions. This can be explained again with the correc- 
tion term that scales linearly with the dimension. When 
comparing higher dimensions to the qubit case, one can 
see that for certain error rates the dimensions bigger than 
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two are advantegous. The dimension d = 3 for example, 
gives a lower threshold value A^o for non-zero key rates 
than the qubit case throughout all the presented error 
rates. 



VII. CONCLUSION 

We have improved the secret key rates in QKD with 
a finite number of signals, by considering parameter es- 
timation to be implemented by a single POVM for all 
parameters. Additionally, we have calculated the min- 
entropy for a single-signal state in d-dimensions explic- 
itly by using its operational meaning via the guessing 
probability. We showed that using this ansatz for a small 
number of signals leads to computable non-zero key rates. 
This advantage of the min-entropy might be due to the 
correction term A in key rate calculations using the con- 
ditional von Neumann entropy [9l HH [15], as this cor- 
rection is big for a small number of signals. This cor- 
rection term scales linearly with the dimension, so an 
improvement for high dimensions (up to d — 17) is found 
by calculating the min-entropy. Thus higher-dimensional 
systems might be advantageous when resources are lim- 
ited. As a spin-off, we have deduced from the additivity 
property of the min-entropy and its relation to the guess- 
ing probability, that the optimal minimum-error discrim- 
ination measurement (MED) for a set of tensor product 
states with a certain symmetry is the optimal MED mea- 
surement on each subsystem. 

Considering the importance of finite-key analysis for 
practical implementations, we have shown that non-zero 
secure key rates can be achieved already with 10 4 — 10 5 
signals per run. 
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Appendix A: Proof of Theorem [T] 



Proof. We first show that Prob 



Am Aqo 



>2£ 



< 



£pe- Starting from the law of large numbers 

Prob \D(X m \\U > 2<Tl < 2~< 2 ^ 1J ^ m ), 



(Al) 



with D 



(AmllAoo) := Ei=i'W0 lo g2 (x^jiy) and usin S 



1 

2 

we result in 



< / £>(A m ||A 00 )ln2 (A2) 



Prob 



Prob 



Am Aqo 



> 



2£' In 2 



D(A m ||A 00 )ln2 /2£'ln2 

— 2 — > v^~ 



2 _ m (2 £ '-| x |^+i))^ 



(A3) 



For £ := J it follows: 



Prob 


"1 

2 


A m 


— Aqo 


>2£ 




Prob 


1 

2 


Am 


— Aqo 




2(4f) In 2 
2 



9 2 -m(2(4C')-|xl^±a 



= 2 v — / =: e PE . 

Then except with probability £pe, the following holds: 



Am -^oo 



with £ 
1 



,/ ln (^i) + '*' ln (" I+1 ) 

V 8m 



. y ii ^m Aqo 1 1 2 — ^ I X m *^oo\ — ^ y 



<2e 

It remains to show that 
1 1 



Ayn Aqq 



Remember that we denote by A m := A TO (fe) and :— 
Aoo(fc) any k-th parameter. The normalization conditions 

of the POVM Y,[=i MO = 1 = EiSi X m{i) lead to 



Ixl 



A m (i)-Aoo(i) 

Ixl 

< IM0~M0l (A4) 

i— l,i^k 



A 



and 



2 , |A m («) - Aoo(i)| > 2|A m - A c 



The assertion follows by multiplication with factor 4 . □ 
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